Method, device, gateway and storage medium for identifying Internet of Things devices

Abstract

The present invention is applicable to the field of computer technology and provides an Internet of Things device identification method, device, gateway and storage medium. The method includes: dividing network communication data from the Internet of Things device according to time windows of preset sizes to obtain data packets corresponding to each time window; extracting the communication fingerprint left by the Internet of Things device on each data packet, and obtaining a communication fingerprint set of the Internet of Things device based on the communication fingerprint, wherein the communication fingerprint is obtained based on a domain name set queried by the Internet of Things device through the data packet and a target node set for communication; obtaining a list of suspected devices associated with the Internet of Things device based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library; and setting the identity tag that appears most frequently in the list of suspected devices as the identity tag of the Internet of Things device, thereby improving the identification efficiency of the Internet of Things device.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to an Internet of Things device identification method, device, gateway and storage medium. Background Art

[0002] The Internet of Things (IoT) connects physical objects (such as machines, devices, and sensors) through a network, enabling them to interact and share data. In recent years, with the continuous improvement of computer hardware manufacturing capabilities and the rise of services such as cloud computing, IoT research has made significant progress, including in IoT sensor technology and IoT data processing. Simultaneously, the scope of IoT applications is constantly expanding, and IoT can now be found in various fields such as smart homes, smart transportation, smart manufacturing, smart healthcare, and smart agriculture.

[0003] While IoT technology has significantly improved people's quality of life across various sectors, it has also brought with it a host of security and privacy issues. Researchers have found that many IoT devices are fundamentally insecure. For example, some smart children's toys fail to adhere to mandated privacy policies, allowing third-party platforms to collect data from the devices and construct detailed profiles of children's behavior. Furthermore, relevant research has shown that even encrypted network traffic can be used to infer users' daily behavior patterns. These studies demonstrate that the weak security of IoT devices poses significant challenges to network security and management.

[0004] Identifying the types of devices in the current network can help address the cybersecurity risks and network management challenges brought about by the rapid expansion of the IoT market. Compared to general-purpose computers, IoT devices are more heterogeneous and often have different network quality of service (QoS) requirements, such as bandwidth requirements or tolerance for packet loss. For example, an internet-connected camera requires higher bandwidth than a smart lightbulb, as is evident when streaming video from an IP camera. Similarly, a smart smoke alarm or smart door lock requires more reliable communication than a smart speaker. This is because unreliable network communication can cause message transmission failures and potentially endanger the user's life. Consequently, IoT devices of the same type often have similar QoS and security requirements. For example, high-end IP cameras from the same manufacturer may have similar bandwidth requirements, and devices from a given manufacturer running the same firmware version may share the same security vulnerabilities. Therefore, identifying the types of devices in the current network allows for the assignment of consistent QoS requirements and security policies to devices of the same type, enabling more efficient network management and security assurance. Current research on IoT device identification still has many limitations. These efforts primarily leverage the diverse traffic characteristics of different devices to train models using supervised learning in machine learning to classify devices. Compared to general-purpose computers or mobile phones, IoT devices exhibit more regular network traffic patterns. For example, IoT devices typically communicate with a limited set of servers, and traffic peaks significantly when interacting with users. Leveraging these traffic characteristics can identify specific device types. Numerous studies have focused on identifying IoT devices based on traffic characteristics, differing between these approaches in the selected traffic characteristics or the machine learning algorithms employed. However, these approaches essentially rely on massive amounts of labeled data to train classifiers to distinguish between different devices. This supervised learning approach to device classification has become less applicable as the number and types of IoT devices continue to grow. This is because it relies on training models with large amounts of labeled data, which requires significant human and time costs to maintain and struggles to capture the emerging IoT devices. Summary of the Invention

[0005] The purpose of the present invention is to provide an Internet of Things device identification method, device, gateway and storage medium, aiming to solve the problem that the existing technology cannot provide an effective Internet of Things device identification method, resulting in poor Internet of Things device identification efficiency.

[0006] In a first aspect, the present invention provides a method for identifying an IoT device, the method comprising the following steps:

[0007] Divide the network communication data from IoT devices according to the time windows of preset sizes to obtain the data packets corresponding to each time window;

[0008] Extracting the communication fingerprint left by the IoT device on each data packet, and obtaining a communication fingerprint set of the IoT device based on the communication fingerprint, wherein the communication fingerprint is obtained based on a set of domain names queried by the IoT device through the data packet and a set of target nodes for communication;

[0009] Based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library, obtaining a list of suspected devices associated with the IoT device;

[0010] The identity tag that appears most times in the suspected device list is set as the identity tag of the IoT device.

[0011] In some embodiments, the step of extracting the communication fingerprint left by the IoT device on each data packet includes:

[0012] The domain name set queried by the IoT device through the data packet and the target node set communicated through the data packet are obtained from each data packet, and based on the domain name set and the target node set, a communication fingerprint left by the IoT device on the data packet is generated.

[0013] In some embodiments, the step of obtaining a list of suspected devices associated with the IoT device based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library includes:

[0014] Obtain the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library. If the similarity between the current communication fingerprint and the current device fingerprint is greater than a similarity threshold, add the identity tag associated with the current device fingerprint to the suspected device list of the IoT device.

[0015] In some embodiments, the step of obtaining the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library includes:

[0016] By formula The similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library, where S (a,b) Indicates the similarity between communication fingerprint a and device fingerprint b, Y a 、Y b They represent the domain name sets corresponding to the communication fingerprint a and device fingerprint b, respectively. a 、D b They represent the target node sets corresponding to obtaining the communication fingerprint a and device fingerprint b respectively.

[0017] In some embodiments, the time window is 30 minutes and the similarity threshold is 0.6.

[0018] In a second aspect, the present invention provides an IoT device identification device, the device comprising:

[0019] A data partitioning unit is used to partition the network communication data from the IoT device according to time windows of preset sizes to obtain data packets corresponding to each time window;

[0020] a fingerprint acquisition unit, configured to extract a communication fingerprint left by the IoT device on each data packet, and acquire a communication fingerprint set of the IoT device based on the communication fingerprint, wherein the communication fingerprint is obtained based on a set of domain names queried by the IoT device through the data packet and a set of target nodes for communication;

[0021] a device list acquiring unit, configured to acquire a list of suspected devices associated with the IoT device based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library; and

[0022] The tag setting unit is configured to set the identity tag that appears most frequently in the suspected device list as the identity tag of the IoT device.

[0023] In some embodiments, the fingerprint acquisition unit includes:

[0024] The fingerprint generation unit is used to obtain from each data packet the domain name set queried by the IoT device through the data packet and the target node set communicated through the data packet, and generate a communication fingerprint left by the IoT device on the data packet based on the domain name set and the target node set.

[0025] In some embodiments, the device list obtaining unit includes:

[0026] The tag adding unit is used to obtain the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library, and if the similarity between the current communication fingerprint and the current device fingerprint is greater than a similarity threshold, add the identity tag associated with the current device fingerprint to the suspected device list of the Internet of Things device.

[0027] In a third aspect, the present invention further provides a gateway, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-described method when executing the computer program.

[0028] In a fourth aspect, the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described above are implemented.

[0029] The present invention divides network communication data from an IoT device according to time windows of preset sizes, obtains data packets corresponding to each time window, extracts communication fingerprints left by the IoT device on each data packet, obtains a communication fingerprint set of the IoT device based on the communication fingerprints, the communication fingerprints are obtained based on a domain name set queried by the IoT device through the data packet and a target node set for communication, obtains a list of suspected devices associated with the IoT device based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library, and sets the identity tag that appears most frequently in the list of suspected devices as the identity tag of the IoT device, thereby improving the recognition efficiency of IoT devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a flow chart of the method for identifying an IoT device provided in the first embodiment of the present invention;

[0031] Figure 2 1 is a flow chart of a method for identifying an IoT device according to a second embodiment of the present invention;

[0032] Figure 3 This is a schematic diagram of the structure of the IoT device identification device provided in the third embodiment of the present invention;

[0033] Figure 4 It is a schematic diagram of the structure of the gateway provided in the fourth embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0035] It should be understood that when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or combinations thereof. Furthermore, the terminology used in this specification is for the purpose of describing specific embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise. The terms "first," "second," and similar terms do not denote any order, quantity, or importance, but are simply used to distinguish one component from another. Terms such as "connected" or "connected" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positions; if the absolute position of the described objects changes, such relative positions may also change accordingly.

[0036] In order to keep the following description of the embodiments of the present invention clear and concise, detailed descriptions of some known functions and components are omitted in this specification.

[0037] The following describes the specific implementation of the present invention in detail with reference to specific embodiments:

[0038] Example 1:

[0039] Figure 1 The implementation process of the IoT device identification method provided in the first embodiment of the present invention is shown. For ease of explanation, only the part related to the embodiment of the present invention is shown, which is detailed as follows:

[0040] In step S101, network communication data from IoT devices is divided according to time windows of preset sizes to obtain data packets corresponding to each time window;

[0041] The embodiments of the present invention are applicable to network interconnection devices, such as gateways, and specifically, to local gateways connected to IoT devices, so as to identify connected IoT devices. When network communication data is received from an IoT device, the current or current network communication data from the IoT device is divided according to a time window (duration) of a preset size to obtain data packets corresponding to each time window. The size of the time window can be set according to the recognition accuracy and storage overhead of the preset network interconnection device. When dividing the network communication data from the IoT device, specifically, the received network communication data can be divided in real time according to the time window of the preset size, that is, while continuously receiving the network communication data of the IoT device, the network communication data is divided into corresponding data packets according to the time window of the preset size, thereby improving the recognition efficiency of subsequent IoT devices. In some embodiments, after receiving the complete network communication data sent by an IoT device, the received complete network communication data can also be divided according to the time window of the preset size to obtain multiple corresponding data packets at one time.

[0042] In step S102, the communication fingerprint left by the IoT device on each data packet is extracted, and a communication fingerprint set of the IoT device is obtained based on the communication fingerprint;

[0043] In an embodiment of the present invention, the communication fingerprint in the communication fingerprint set is used to characterize the characteristics or identity of the Internet of Things device in the current network communication. When obtaining the communication fingerprint set, the communication fingerprint left by the Internet of Things device on each data packet is extracted, and the communication fingerprints on all data packets corresponding to the current network communication data constitute the communication fingerprint set of the Internet of Things device. The communication fingerprint on each data packet is obtained based on the domain name set queried by the Internet of Things device through the data packet and the target node set for communication. Specifically, when obtaining the communication fingerprint on each data packet, the domain name set and the target node set data can be spliced, and the hash value of the spliced data can be used as the communication fingerprint on the data packet. The domain name set is the domain name set queried by the current data packet or the domain name set contained in the current data packet, and the target node set is the set of target nodes or locations to which the data packet of the Internet of Things device is sent.

[0044] In step S103, based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library, a list of suspected devices associated with the IoT device is obtained;

[0045] In an embodiment of the present invention, a preset device fingerprint library stores the communication fingerprints of the IoT devices that have been identified, verified, or connected, and the corresponding identity tags or identifiers. After obtaining the communication fingerprint set of the IoT device, each communication fingerprint in the communication fingerprint set is matched with the preset device fingerprint library, and the device (device tag or identifier) associated with each communication fingerprint matching the fingerprint in the device fingerprint library is obtained. The device tag or identifier of the device can be considered as the suspected device tag of the IoT device. All device tags or identifiers matched by all communication fingerprints in the obtained communication fingerprint set constitute a suspected device list associated with the IoT device. Devices with multiple communication fingerprint matches may be the same device. Therefore, multiple device tags (devices) in the suspected device list can be the same.

[0046] In step S104, the identity tag that appears most frequently in the list of suspected devices is set as the identity tag of the IoT device.

[0047] In an embodiment of the present invention, the suspected device list lists possible devices (device tags) corresponding to the communication fingerprints on all data packets of the IoT device. In order to improve the identity recognition accuracy of the IoT device in the current communication, the identity tag that appears most frequently in the suspected device list is set as the identity tag of the IoT device, thereby realizing the identification of the IoT device. While improving the identification accuracy, the device identification process is simplified.

[0048] The embodiment of the present invention divides network communication data from an Internet of Things device according to a time window of a preset size, obtains a data packet corresponding to each time window, extracts a communication fingerprint left by the Internet of Things device on each data packet, obtains a communication fingerprint set of the Internet of Things device based on the communication fingerprint, and obtains the communication fingerprint based on a domain name set queried by the Internet of Things device through the data packet and a target node set for communication. Based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library, a list of suspected devices associated with the Internet of Things device is obtained, and the identity tag that appears most frequently in the suspected device list is set as the identity tag of the Internet of Things device, thereby simplifying the identification process of the Internet of Things device and improving the identification efficiency of the Internet of Things device.

[0049] Example 2:

[0050] Figure 2 The following illustrates an implementation process of the IoT device identification method provided in the second embodiment of the present invention. For ease of illustration, only the portion related to the embodiment of the present invention is shown, which is described in detail as follows:

[0051] In step S201, network communication data from IoT devices is divided according to time windows of preset sizes to obtain data packets corresponding to each time window;

[0052] Embodiments of the present invention are applicable to network interconnection devices, such as gateways, and more specifically, to local gateways connected to IoT devices, for identifying connected IoT devices. When receiving network communication data from an IoT device, the current or current network communication data from the IoT device is divided according to a preset time window (duration) to obtain data packets corresponding to each time window. The size of the time window can be set based on a preset network interconnection device identification accuracy and storage overhead. In some specific implementations, the time window size is 30 minutes, which provides a good balance between identification accuracy and storage overhead. When dividing the network communication data from the IoT device, the received network communication data can be divided in real time according to a preset time window size. That is, while continuously receiving the network communication data from the IoT device, the network communication data is divided into corresponding data packets according to the preset time window size, thereby improving the efficiency of subsequent IoT device identification. In some embodiments, after receiving the complete network communication data sent by an IoT device, the received complete network communication data can be divided according to the preset time window size to obtain multiple corresponding data packets at once.

[0053] In step S202, a domain name set queried by the IoT device through the data packet and a target node set communicated with through the data packet are obtained from each data packet. Based on the domain name set and the target node set, a communication fingerprint left by the IoT device on the data packet is generated. Based on the communication fingerprint, a communication fingerprint set of the IoT device is obtained.

[0054] In an embodiment of the present invention, the communication fingerprint in the communication fingerprint set is used to characterize the characteristics or identity of the Internet of Things device in the current network communication. When obtaining the communication fingerprint set, the communication fingerprint left by the Internet of Things device on each data packet is extracted, and the communication fingerprints on all data packets corresponding to the current network communication data constitute the communication fingerprint set of the Internet of Things device. The communication fingerprint on each data packet is obtained based on the domain name set queried by the Internet of Things device through the data packet and the target node set for communication. Specifically, when obtaining the communication fingerprint on each data packet, the domain name set and the target node set data can be spliced, and the hash value of the spliced data can be used as the communication fingerprint on the data packet. The domain name set is the domain name set queried by the current data packet or the domain name set contained in the current data packet, and the target node set is the set of target nodes or locations to which the data packet of the Internet of Things device is sent.

[0055] In some embodiments, when extracting the communication fingerprint left by an IoT device on each data packet, a set of domain names queried by the IoT device through the data packet and a set of target nodes communicated with through the data packet are obtained from each data packet. Based on the set of domain names and the set of target nodes, a communication fingerprint left by the IoT device on the data packet is generated. Specifically, when obtaining the set of domain names queried by the IoT device through the data packet, if the protocol type used by the current data packet is the DNS protocol, the domain name information queried by the data packet is added to the set of domain names. If the protocol type used by the current data packet is not the DNS protocol, the set of domain names contained in the current data packet is directly obtained.

[0056] In step S203, the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library is obtained. If the similarity between the current communication fingerprint and the current device fingerprint is greater than a similarity threshold, the identity tag associated with the current device fingerprint is added to the suspected device list of the IoT device;

[0057] In an embodiment of the present invention, the communication fingerprints of the IoT devices that have been identified, verified or accessed and the corresponding identity tags or identifiers are stored in the preset device fingerprint library. After obtaining the communication fingerprint set of the IoT device, each communication fingerprint in the communication fingerprint set is matched with the preset device fingerprint library to obtain the device (device tag or identifier) associated with the fingerprint matching each communication fingerprint in the device fingerprint library. Specifically, when obtaining a list of suspected devices associated with the IoT device, the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library is obtained. If the similarity between the current communication fingerprint and the current device fingerprint is greater than the similarity threshold, the identity tag associated with the current device fingerprint is added to the suspected device list of the IoT device. The device tag or identifier of the device can be considered as the suspected device tag of the IoT device. All device tags or identifiers matched by all communication fingerprints in the obtained communication fingerprint set constitute the suspected device list associated with the IoT device. The devices matched by multiple communication fingerprints may be the same device. Therefore, multiple device tags (devices) in the suspected device list can be the same. The similarity threshold can be set based on the size of the time window. A too small similarity threshold can confuse different IoT devices from the same manufacturer, or even misidentify a large number of different IoT devices as the same device. A too large similarity threshold can misidentify fingerprints from the same IoT device with slight differences. Experiments have shown that the similarity threshold is set between 0.5 and 1.0, with a preferred value of 0.6. This matches the size of the time window and improves the efficiency of subsequent IoT device recognition.

[0058] In some embodiments, the formula Calculate the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library, that is, by calculating the intersection Y of the domain name set a ∩Y b The modulus of the union Y a ∪Y b The module length of the target node set is D a ∩D b The modulus of the union D a ∪D b The similarity between the communication fingerprint a and the device fingerprint b can be obtained by adding the modulus length of the communication fingerprint a and the device fingerprint b, thereby improving the accuracy of the similarity calculation and simplifying the matching process of the communication fingerprint. (a,b) Indicates the similarity between communication fingerprint a and device fingerprint b, Y a 、Y b They represent the domain name sets corresponding to the communication fingerprint a and device fingerprint b, respectively. a 、D b They represent the target node sets corresponding to obtaining the communication fingerprint a and device fingerprint b respectively.

[0059] In step S204, the identity tag that appears most frequently in the list of suspected devices is set as the identity tag of the IoT device.

[0060] In an embodiment of the present invention, the suspected device list lists possible devices (device tags) corresponding to the communication fingerprints on all data packets of the IoT device. In order to improve the identity recognition accuracy of the IoT device in the current communication, the identity tag that appears most frequently in the suspected device list is set as the identity tag of the IoT device, thereby realizing the identification of the IoT device. While improving the identification accuracy, the device identification process is simplified.

[0061] Example 3:

[0062] Figure 3 The structure of the IoT device identification device provided in the third embodiment of the present invention is shown. For ease of explanation, only the parts related to the embodiment of the present invention are shown, including:

[0063] The data partitioning unit 31 is used to partition the network communication data from the IoT device according to time windows of preset sizes to obtain data packets corresponding to each time window;

[0064] A fingerprint acquisition unit 32 is configured to extract a communication fingerprint left by the IoT device on each data packet, and acquire a communication fingerprint set of the IoT device based on the communication fingerprint, wherein the communication fingerprint is acquired based on a set of domain names queried by the IoT device through the data packet and a set of target nodes for communication;

[0065] A device list acquisition unit 33 is configured to acquire a list of suspected devices associated with the IoT device based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library; and

[0066] The tag setting unit 34 is configured to set the identity tag that appears most frequently in the suspected device list as the identity tag of the IoT device.

[0067] In some embodiments, the fingerprint acquisition unit 32 may include:

[0068] The fingerprint generation unit is used to obtain from each data packet the domain name set queried by the IoT device through the data packet and the target node set communicated through the data packet, and generate a communication fingerprint left by the IoT device on the data packet based on the domain name set and the target node set.

[0069] In some embodiments, the device list obtaining unit 33 may include:

[0070] The tag adding unit is used to obtain the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library. If the similarity between the current communication fingerprint and the current device fingerprint is greater than the similarity threshold, the identity tag associated with the current device fingerprint is added to the suspected device list of the IoT device.

[0071] An embodiment of the present invention divides network communication data from an IoT device according to time windows of preset sizes, obtains data packets corresponding to each time window, extracts communication fingerprints left by the IoT device on each data packet, obtains a communication fingerprint set of the IoT device based on the communication fingerprints, and obtains the communication fingerprints based on a set of domain names queried by the IoT device through the data packet and a set of target nodes for communication. Based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library, a list of suspected devices associated with the IoT device is obtained, and the identity tag that appears most frequently in the list of suspected devices is set as the identity tag of the IoT device, thereby improving the recognition efficiency of the IoT device.

[0072] In the embodiments of the present invention, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functional distribution can be implemented by different functional units and modules as needed, that is, the internal structure of the device is divided into different functional units or modules to implement all or part of the functions described above. The various units and modules of the device can be implemented by corresponding hardware or software units. Each unit and module can be an independent software or hardware unit, or can be integrated into a software or hardware unit, which is not intended to limit the present invention. In addition, the specific names of the various functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the device can refer to the corresponding description in the aforementioned method embodiment, which will not be repeated here.

[0073] Example 4:

[0074] Figure 4 The structure of the gateway provided by the fourth embodiment of the present invention is shown. For the convenience of description, only the parts related to the embodiment of the present invention are shown.

[0075] The gateway 4 of the embodiment of the present invention includes a processor 40, a memory 41, and a computer program 42 stored in the memory 41 and executable on the processor 40. When the processor 40 executes the computer program 42, the steps in the above-mentioned various IoT device identification method embodiments are implemented, such as Figure 1 Alternatively, when the processor 40 executes the computer program 42, the functions of each unit in the above-mentioned device embodiments are realized, for example Figure 3 The functions of the units 31 to 34 are shown.

[0076] The gateway in the embodiment of the present invention can be a network interconnection device, for example, a gateway, specifically a local gateway suitable for accessing IoT devices to identify the connected IoT devices. The steps implemented by the processor 40 in the gateway 4 when executing the computer program 42 to implement the IoT device identification method can be referred to the description of the aforementioned method embodiment and will not be repeated here.

[0077] Embodiment 5:

[0078] In an embodiment of the present invention, a computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned embodiment of the method for identifying an IoT device are implemented. For example, Figure 1 Alternatively, when the computer program is executed by a processor, the functions of each unit in the above-mentioned device embodiment are realized, for example Figure 3 The functions of the units 31 to 34 are shown.

[0079] In an embodiment of the present invention, the embodiment of the present invention divides network communication data from an Internet of Things device according to a time window of a preset size, obtains a data packet corresponding to each time window, extracts a communication fingerprint left by the Internet of Things device on each data packet, obtains a communication fingerprint set of the Internet of Things device based on the communication fingerprint, and obtains the communication fingerprint based on the domain name set queried by the Internet of Things device through the data packet and the target node set for communication. Based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library, a list of suspected devices associated with the Internet of Things device is obtained, and the identity tag that appears most times in the suspected device list is set as the identity tag of the Internet of Things device, thereby improving the recognition efficiency of the Internet of Things device.

[0080] The computer-readable storage medium of an embodiment of the present invention may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In an embodiment of the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or component.

[0081] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the scope of disclosure involved in the above embodiments is not limited to the technical solutions formed by the specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concepts. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0082] In addition, although adopting specific order to describe each operation, this should not be interpreted as requiring these operations to be executed in the specific order shown or in sequential order.Under certain environment, multitasking and parallel processing may be advantageous.Similarly, although comprising some specific implementation details in the above discussion, these should not be interpreted as limiting the scope of the present invention.Some features described in the context of independent embodiment can also be implemented in single embodiment in combination.On the contrary, the various features described in the context of independent embodiment also can be implemented in multiple embodiments individually or in the mode of any suitable subcombination.

Claims

1. A method for identifying an Internet of Things device, characterized in that: The method comprises the following steps: Divide the network communication data from IoT devices according to the time windows of preset sizes to obtain the data packets corresponding to each time window; Extracting the communication fingerprint left by the IoT device on each data packet, and obtaining a communication fingerprint set of the IoT device based on the communication fingerprint, wherein the communication fingerprint is obtained based on a set of domain names queried by the IoT device through the data packet and a set of target nodes for communication; Based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library, obtaining a list of suspected devices associated with the IoT device; The identity tag that appears most times in the suspected device list is set as the identity tag of the IoT device.

2. The method according to claim 1, wherein The step of extracting the communication fingerprint left by the IoT device on each data packet includes: The domain name set queried by the IoT device through the data packet and the target node set communicated through the data packet are obtained from each data packet, and based on the domain name set and the target node set, a communication fingerprint left by the IoT device on the data packet is generated.

3. The method according to claim 1, wherein The step of obtaining a list of suspected devices associated with the IoT device based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library includes: Obtain the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library. If the similarity between the current communication fingerprint and the current device fingerprint is greater than a similarity threshold, add the identity tag associated with the current device fingerprint to the suspected device list of the IoT device.

4. The method according to claim 3, wherein The step of obtaining the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library includes: By formula Calculate the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library, where: S(a,b) Indicates the similarity between communication fingerprint a and device fingerprint b, Ya, Yb They represent the domain name sets corresponding to the communication fingerprint a and device fingerprint b, respectively. Da、Db They represent the target node sets corresponding to obtaining the communication fingerprint a and device fingerprint b respectively.

5. The method according to claim 3, wherein The size of the time window is 30 minutes, and the similarity threshold is 0.

6.

6. An IoT device identification device, characterized in that: The device comprises: A data partitioning unit is used to partition the network communication data from the IoT device according to time windows of preset sizes to obtain data packets corresponding to each time window; a fingerprint acquisition unit, configured to extract a communication fingerprint left by the IoT device on each data packet, and acquire a communication fingerprint set of the IoT device based on the communication fingerprint, wherein the communication fingerprint is obtained based on a set of domain names queried by the IoT device through the data packet and a set of target nodes for communication; a device list acquiring unit, configured to acquire a list of suspected devices associated with the IoT device based on each communication fingerprint in the communication fingerprint set and a preset device fingerprint library; and The tag setting unit is configured to set the identity tag that appears most frequently in the suspected device list as the identity tag of the IoT device.

7. The device according to claim 6, characterized in that The fingerprint acquisition unit includes: The fingerprint generation unit is used to obtain from each data packet the domain name set queried by the IoT device through the data packet and the target node set communicated through the data packet, and generate a communication fingerprint left by the IoT device on the data packet based on the domain name set and the target node set.

8. The device according to claim 6, wherein The device list acquisition unit includes: The tag adding unit is used to obtain the similarity between each communication fingerprint in the communication fingerprint set and each device fingerprint in the device fingerprint library, and if the similarity between the current communication fingerprint and the current device fingerprint is greater than a similarity threshold, add the identity tag associated with the current device fingerprint to the suspected device list of the Internet of Things device.

9. A gateway comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images